Planning for Mass Casualty Incidents: Emergency Treatment and Privacy Considerations

There are multiple definitions for what constitutes a “mass casualty incident” (MCI).  For the Department of Justice, Community Oriented Policing Services Division, an MCI is an event in which four or more individuals are shot, whether wounded or killed, excluding the perpetrator.² Under federal law, a mass killing is defined as three or more killed in a single incident.³ However, for healthcare facilities, exact numbers aren’t always critical.  A major urban trauma center may be equipped to deal with four critically injured patients, while a small suburban facility would be overwhelmed by such a situation. Thus, the best definition of an MCI may be “the number of casualties that exceed the resources normally available from local resources. This is based upon available resources, number of injuries, and severity of injuries.”⁴  It is this type of MCI, one that exceeds a facility’s normal capacity, that requires the most advance planning and preparation.

Unlike natural disasters, which can occur over days, an MCI can happen quickly, often within minutes, and without notice.  Although earthquakes share these same characteristics, the damage from an earthquake is typically spread over a wider area and the emergency response will often involve multiple facilities.  With an MCI, the hospital nearest to the incident can be immediately overwhelmed.  While a full discussion of the legal requirements for emergency preparedness is beyond the scope of this article, this article will discuss a hospital’s EMTALA obligations during an MCI, applicable HIPAA requirements, including the limitations of public disclosures, a frequent issue with newsworthy events, and finally, unexpected operational issues experienced by facilities that have faced MCIs within their communities.   

EMTALA

The Emergency Medical Treatment and Labor Act (EMTALA) requires all Medicare-participating hospitals with emergency departments to provide any individual who comes to the emergency department, regardless of ability to pay, with the following services:

1.      An appropriate medical screening exam (MSE) to determine if the individual has an emergency medical condition (EMC).  If there is no EMC, a hospital has no further EMTALA obligation.⁵

2.      If there is an EMC, a hospital must either (i) treat and stabilize the EMC within the capability of the hospital, including the admission of the individual; or (ii) appropriately transfer the individual to a hospital that has the capability and capacity to stabilize the MCE if the presenting hospital is unable to do so.⁶

Complying with EMTALA can be challenging during an MCI.  These events occur extremely quickly and patients may arrive at the hospital with little or no notice.  Further, because they often occur in a single location, the nearest hospital will receive a disproportionate number of victims.  Diversion protocols established within emergency medical services (EMS) systems may do little to prevent this surge, as many patients either self-transport or are transported by friends or family. Although there are certain circumstances under which a hospital’s EMTALA obligations can be waived, these criteria will unlikely be present with an MCI.⁷  However, there are strategies that can be implemented in the event of a significant surge in emergency department (ED) patients without the need to obtain a waiver.

Alternative Screening Sites on Campus 

It is not required that an MSE be conducted within the hospital’s ED; the hospital can set up alternative screening sites on campus.⁸ Patients can be redirected to these alternate sites even prior to arrival at the ED, although the person directing potential patients must be qualified to recognize those who need immediate emergency treatment.  Further, patients must be logged in prior to being redirected.⁹  However, absent an EMTALA waiver issued by the Centers for Medicare & Medicaid Services (CMS), hospitals may not direct an individual who has arrived at the ED to any off-campus locations.¹⁰  Once a patient is directed to an alternate site on-campus, the patient must receive an MSE, although the scope of the required screening will depend upon the patient’s clinical symptoms.  Any MSE conducted outside the ED must be performed by qualified clinical personnel, and if a patient is determined to have an EMC, the patient must be provided stabilizing treatment or an appropriate transfer.¹¹

Other Internal Tactics

There are additional specific strategies hospitals can consider in coping with a sudden influx of injured patients, such as early discharge planning, opening additional beds, and the use of remote locations.¹²  For an outpatient surge, the use of tents or mobile facilities located on or within a hospital’s campus are potential coping strategies as long as such facilities meet all CMS Conditions of Participation as was well as any state, county, or life safety code requirements.¹³

Coordinated Community Care

A hospital can consider coordinating triage and the redistribution of patients with local EMS authorities and other regional hospitals through the use of a community wide plan (this is distinct from a community call plan). In such circumstances, a qualified practitioner would be required to conduct an MSE and, as appropriate, patients would be directed to the hospital or transferred to other receiving facilities who have agreed to accept patients.¹⁴  In its guidance entitled “EMTALA and Disasters,” the Health and Human Services’ Office of the Assistant Secretary for Preparedness and Response, Technical Resources, Assistance Center, and Information Exchange (ASPR TRACIE), provided an example of EMTALA compliant arrangements utilizing a community plan. In its example, ASPR TRACIE stated that if the capacity of local hospitals was determined based upon a pre-existing plan (e.g., hospitals A, B & C can accommodate 50 critical, 100 immediate and 300 ambulatory patients), a qualified practitioner could perform an MSE and redirect and coordinate transfer of those patients without having to speak directly, clinician to clinician, to the receiving hospital for each patient.¹⁵ However, it should be noted that the EMTALA Interpretive Guidelines for surveyors, issued by CMS, do not appear to echo the language indicating that use of a community plan acts as the de facto consent required from a receiving hospital prior to transfer.¹⁶ As identified, this type of patient transfer should only be conducted in compliance with pre-established community planning efforts.

HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) is designed to safeguard a patient’s protected health information (PHI), while also ensuring that such PHI can be disclosed and utilized by facilities, practitioners and individuals, as necessary, to provide treatment to the patient. However, during an MCI, determining the appropriate use and disclosure of PHI can be a challenge. Many patients will be incapacitated and arrive without wallets and purses, complicating the task of identification and determining who is a family member.  Multiple law enforcement agencies will likely be involved and require patient information.  Further, with today’s 24/7 news cycle, it can be expected that reporters will be omnipresent and requesting constant updates. Despite the difficult circumstances, it will be incumbent on hospitals to implement sufficient safeguards to protect patient information against impermissible disclosures.

Family and Friends

A hospital may share PHI to assist in the identification of the patient or to locate his or her family members.  Further, a hospital may share PHI with family members and friends or other persons identified by the patient as involved in the patient’s care.  However, the hospital must (i) obtain the patient’s agreement to the disclosure, (ii) be able to reasonably infer the patient does not object to the disclosure, or (iii) determine the sharing of such PHI, under the circumstances, is in the best interest of the patient.¹⁷

Disaster Relief Organizations

A hospital may release patient information to disaster relief organizations, such as the Red Cross, to coordinate efforts with such organizations in identifying victims or notifying family members. However, it is not necessary to obtain the patient’s authorization to share the information if it will interfere with the organization’s ability to respond.¹⁸

Media and Others

When information is requested about a patient by name, a hospital may release limited directory information to verify that the individual is in the hospital.  Additionally, a general description of the patient’s condition (e.g., critical, stable, fair) may be released and members of the clergy may be informed of the patient’s religious affiliation, provided the patient has not objected to or otherwise limited such disclosures.  If the patient is incapacitated, the disclosure is permissible if it is believed to be in the best interest of the patient and is consistent with any prior expressed wishes of the patient.¹⁹ Specific information about a patient, such as identified condition or test results, may not be disclosed without a written authorization.

Law Enforcement

A hospital may release information to law enforcement as required by law.²⁰  Additionally, when a patient is a potential victim of a crime, PHI may be disclosed to law enforcement upon the authorization of the patient or, if the patient is incapacitated, upon the officials’ representation that (i) the PHI is necessary to determine whether there has been a violation of the law, (ii) the PHI obtained will not be used against the victim, and (iii) the investigation would be materially and adversely affected by waiting until the victim can agree to the request.  Additionally, it must be determined, in the professional judgment of hospital clinical personnel, the disclosure of information is in the best interest of the patient.²¹

If the patient is the suspected perpetrator, a hospital may disclose information necessary for purposes of identifying or locating the suspect.  This may include name and address, date and place of birth, social security number, ABO blood type and Rh factor, type of injury, date and time of treatment, distinguishing characteristics (e.g., age, race, gender, scars, tattoos, body hair), and if applicable, date and time of death.²²

Additional HIPAA Issues

In any circumstance involving the sharing or disclosing of information, hospitals must make reasonable efforts to limit the information provided to that minimally necessary to accomplish the intended purpose.²³ It is also in a hospital’s best interest to ensure that its internal policies and procedures regarding the accessing of patient information remain in place and operational and that only employees carrying out their duties view patient information.²⁴  A reminder to employees of the seriousness of inappropriately accessing or disclosing patient information may be warranted.

Other Considerations

Any hospital receiving victims of an MCI will face incredible and unique challenges.  Facilities that have experienced such tragedies within their communities have identified several unexpected issues that were of significant concern.²⁵ These include:

·         The influx of family and friends creating unanticipated challenges.  It is likely that large numbers of friends and family members will arrive at the hospital, resulting in quickly overcrowded waiting rooms and corridors.  They will also be distraught, desperate for information, and in need of an array of resources such as counseling and food service.  A family assistance center should be established as soon as possible to provide a central location to address their specific needs. 

·         The importance of communication planning.  Today, information spreads almost instantaneously.  First person accounts on Facebook and other social medial platforms can appear in real time and, in fact, these postings may be the first notice of an event.  They may also trigger a hunt for information from a worried public, and it can be expected that three family members will call for information for each casualty. ²⁶ This barrage of calls can quickly overwhelm a hospital’s switchboard. Thus, it is imperative that a hospital have the ability to quickly initiate a robust information system.  Additionally, to avoid improper disclosures or the potential spread of misinformation, personnel dealing with the public should be provided specific guidance on the information to be released.  Internal communication must also be carefully coordinated, particularly if temporary screening areas are established.  If cell phones are included in the communication plan, strategies should be in place to recharge batteries or provide external power sources.²⁷

·         The need for increased security.  This may be especially important should the perpetrator be a patient of the hospital.  Family members and friends looking for loved ones may also initially pose security challenges, as many will be desperate, distraught and not at their best.  An insistent press may create further security problems in the aftermath of the event, particularly if the MCI is considered of national significance.  These issues will be magnified if politicians or celebrities choose to become involved.  Other security issues can arise if the MCI occurs inside the hospital or sufficiently close that the hospital is directly impacted by the event.  A hospital may be placed on lock down or access and egress to the facility may be limited.  It must be noted that EMTALA obligations continue in such circumstances, although it is permissible to delay care if to do so presents an immediate risk to providers and they do not believe they can perform an MSE or render stabilizing care without risking their lives.  Further, if patients are unable to reach the hospital campus because of a lockdown, EMTALA would not apply.²⁸

·         The psychological impact on staff.  While hospital staff may be experienced with grieving families and wounded patients, encountering such suffering on a large scale may be emotionally challenging.  The inclusion of members of a hospital’s employee assistance program staff trained in “psychological first aid” should be included in the planning process for responding to MCIs.²⁹

·         The volume of cleaning supplies and janitorial personnel required.  Patients involved in a major MCI will have an array of wounds, including critical injuries.  Operating theaters and exam rooms will be utilized on a continuously rotating basis, and infection control and the risk of contamination may be a serious concern.  A stockpile of cleaning supplies as well the ability to call in additional janitorial staff should be considered.

·         The need to interface with multiple law enforcement agencies.  Individual staff, identified either by name or job title, should be assigned to work with the array of agencies that may potentially be involved with the response to an MCI.  Further, other workforce members should be trained that all law enforcement requests or inquiries are to be forwarded to these individuals. 

Conclusion

The ability to respond immediately and capably to patients of a major MCI will stretch the resources of any facility. Understanding in advance the obligations posed by EMTALA and HIPAA under these circumstances, and the development of mechanisms to comply with such obligations, will be crucial.  It will also be necessary for hospitals to consider and prepare for other concerns that may arise during these tragic events, including communication and security issues, overcrowded waiting rooms and corridors, and traumatized staff and visitors.  Hospitals will be well served by devoting the time and resources necessary to develop carefully thought out strategies to enable them to competently confront the complex challenges inherent in dealing with an MCI. 

1. Thometz, Kristen (August 13, 2019) Northwestern Research Shows US Mass Shootings on the Rise, retrieved from https://news.wttw.com/2019/08/13/northwestern-research-shows-us-mass-shootings-rise.
2. Mass Shootings: Preparing for Violent Events (July 2019), retrieved from https://cops.usdoj.gov/html/dispatch/07-2019/mass_shootings.html.
3. 28 U.S.C. § 530C(b)(1)(M)(i)(I). 
4. DelValle Institute Learning Center, What is a Mass Casualty Incident, retrieved from https://delvalle.bphc.org/mod/wiki/view.php?pageid=89.
5. 42 U.S.C. § 1395dd(a).
6. 42 U.S.C. § 1395dd(b)(1).
7. If the President declares an emergency or disaster, the Secretary of Health and Human Services declares a Public Health Emergency and authorizes the waiver of EMTALA requirements, the hospital has activated its emergency operations plan and the state has activated an emergency operations plan.  See CMS Survey & Certification Letter 09-52 (August 14, 2009).
8. CMS Survey & Certification Letter 09-52 (August 14, 2009).
9. Id.
10. Id.
11. Id.
12. EMTALA and Disasters, (January 2018, Updated May 7, 2018), U.S. Dept. of Health & Human Services, Assistant Secretary for Preparedness and Response, Technical Resources, Assistance Center and Information Exchange, retrieved from https://asprtracie.hhs.gov/technical-resources/resource/5202/emtala-and-disasters.
13. Id., at 4.
14. Id., at 3.
15. Id., at 3.  
16. CMS IOM 100-7, State Operations Manual, Appendix V, Interpretive Guidelines – Responsibilities of Medicare Participating Hospitals in Emergency Cases; 42 C.F.R. § 489.24(e)(2)(B). The author has reached out to CMS for clarification on this issue, but as of the submission date of the article has not yet received a reply.
17. 45 C.F.R.§ 164.510(b)(1)-(3); See also HIPAA for Professionals, FAQs, Disclosures to Family and Friends, retrieved from https://www.hhs.gov/hipaa/for-professionals/faq/2086/does-hipaa-privacy-rule-permit-doctor-discuss-patient-s-health-status.html.
18. 45 C.F.R. § 164.510(b)(4).
19. 45 C.F.R. § 164.510(a) (1)-(2).
20. 45 C.F.R. § 164.512(f )(1); See also HIPAA for Professionals, FAQs, Disclosures for Law Enforcement Purposes, retrieved from https://www.hhs.gov/hipaa/for-professionals/faq/505/what-does-the-privacy-rule-allow-covered-entities-to-disclose-to-law-enforcement-officials/index.html.
21. 45 CFR § 164.512(f)(3).  Note:  If a victim is the spouse or child of the suspected perpetrator, additional disclosure rules may also apply.  See 45 C.F.R. § 164.512(c).
22. 45 C.F.R. § 164.512(f )(2).
23. 45 C.F.R. § 164.514(d)(3).
24. 45 C.F.R. § 164.514(d)(2). See also Texas health system settles potential HIPAA violations for disclosing patient information, retrieved from: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/mhhs/index.html; “Dozens” of Northwestern Memorial Hospital Employees Fired for Accessing Jussie Smollett’s Medical Records (March 8, 2019) HIPAA Journal, retrieved from: https://www.hipaajournal.com/dozens-northwestern-memorial-hospital-employees-fired-medical-records-jussie-smollett/; $999,000 in HIPAA Penalties for Three Hospitals for Boston Med HIPAA Violations (September 20, 2018) HIPAA Journal, retrieved from: https://www.hipaajournal.com/boston-med-hipaa-violation-penalties/.
25. Braxton, Nickie, HIPAA and Mass Casualty Events, retrieved from: www.ehcca.com › presentations › HIPAA26 › braxton_2; Las Vegas Mass Shooting hospital response case study (January 31, 2019), retrieved from: https://www.usfa.fema.gov/operations/infograms/013119.html.
26. Tips for Healthcare Facilities: Assisting Families and Loved Ones after a Mass Casualty Incident, (August 2018), p. 13, U.S. Dept. of Health & Human Services, Assistant Secretary for Preparedness and Response, Technical Resources, Assistance Center and Information Exchange, retrieved from: https://files.asprtracie.hhs.gov › documents › aspr-tracie-family-assistance-....
27. Id. at p.12.
28. EMTALA and Disasters, supra n.12, at 4.
29. Tips for Retaining and Caring for Staff after a Disaster (September 2018), U.S. Dept. of Health & Human Services, Assistant Secretary for Preparedness and Response, Technical Resources, Assistance Center and Information Exchange, retrieved from: https://asprtracie.s3.amazonaws.com/documents/tips-for-retaining-and-caring-for-staff-after-disaster.pdf.

About the Author

Catherine Greaves is a counsel in King & Spalding’s Healthcare Practice in Austin, Texas. She has more than 25 years of experience advising clients involved in all aspects of the healthcare industry. With a focus on state and federal laws related to healthcare, Ms. Greaves regularly counsels clients regarding Medicare, Medicaid and other governmental programs, including coverage and reimbursement matters, governmental audits, internal investigations and compliance issues. She also assists clients with corporate acquisitions, mergers, joint ventures and other complex provider relationships, operational issues, such as licensure and certification, as well as employment and recruitment issues. She has experience advising clients on matters related to HIPAA, HITECH, federal and state healthcare fraud and abuse issues, including anti-kickback laws, physician self-referral prohibitions (Stark Law), false claims, and other sanction issues.  She may be reached at [email protected].